Vulnerability in ath9k_htc package: Potential Out of Bounds Access
Summary
GSD-2022-1003919: ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix. Affects Kernel versions >= 4ed1a8d4a25711f780b96920fff2bb531229e322, < 4bdcf32c965c27f55ccc4ee71c1927131115b0bb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ath9k_htc package is a wireless driver for Atheros IEEE 802.11n devices. It is a part of the Linux Kernel ecosystem and is responsible for enabling wireless communication on compatible hardware. The package provides support for various features such as transmit beamforming, hardware encryption, and multiple virtual interfaces. However, a vulnerability has been discovered in the package that could lead to potential out of bounds access.
Vulnerability Detail
The vulnerability in the ath9k_htc package involves a potential out of bounds access with an invalid rxstatus->rs_keyix. This issue could be exploited by an attacker to gain unauthorized access or execute arbitrary code on a vulnerable system. The vulnerability was introduced in version v3.15 of the Linux Kernel and has been fixed in version v4.19.247 by commit 4bdcf32c965c27f55ccc4ee71c1927131115b0bb. It is important to note that the actual impact and attack plausibility of this vulnerability have not yet been proven.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the ath9k_htc module if it is not required for their system. This can be done by blacklisting the module in the kernel configuration file. To blacklist the module, add the following line to the file '/etc/modprobe.d/blacklist.conf':
blacklist ath9k_htc
After adding the line, reboot the system for the changes to take effect.
Conclusion
In conclusion, the ath9k_htc package in the Linux Kernel is vulnerable to a potential out of bounds access issue. It is recommended to update the Kernel to the fixed version and rebuild/reinstall the ath9k_htc module. If the module is not required, it can be disabled using the provided workaround. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The ath9k_htc package is a wireless driver for Atheros IEEE 802.11n devices in the Linux Kernel ecosystem. It enables wireless communication on compatible hardware.
The impact of this vulnerability is not yet proven, but it could potentially allow an attacker to gain unauthorized access or execute arbitrary code on a vulnerable system.
To fix this vulnerability, update the Linux Kernel to version v4.19.247 or later and rebuild/reinstall the ath9k_htc module. Refer to the provided steps for detailed instructions.
Yes, you can disable the ath9k_htc module by blacklisting it in the kernel configuration file. Refer to the provided workaround section for step-by-step instructions.
For more information about this vulnerability, you can refer to the provided references link in the vulnerability details section.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
